Board demands zero ransomware risk at a regional hospital
Northvale Regional Health (NRH), a 640-bed hospital with 4,800 staff and 22 satellite clinics, has just appointed its first CISO. A ransomware attack on a competitor dominated the board agenda. The board adopted a risk appetite statement saying 'no material risk of ransomware is acceptable' and asked for a risk register that expresses every risk in euros so it can be compared with a €2.5m cyber budget. The CISO knows that clinical availability, patient safety, and regulatory reporting (72-hour breach notification) have different tolerance levels, and that the MRI suite runs an unsupported operating system because the vendor will not certify an upgrade before 2027. The CFO wants a single ranked list by month-end; the CMO insists that any control that slows clinicians is unacceptable. The insurer requires evidence of documented risk criteria and a treatment plan within 90 days.
1. Define the scope, risk criteria, and risk appetite for NRH's first risk assessment. Explain how you would reconcile the board's 'zero risk' wording with ISO/IEC 27005 concepts.
Read the worked answer
Scope and context. Define the scope as all clinical and supporting services at the main site and 22 clinics, including the e-health portal, medical devices, the MRI suite, the EHR, laboratory interfaces, and third-party suppliers. State exclusions and dependencies explicitly. Context includes objectives (patient safety, clinical availability, regulatory compliance), obligations, stakeholders (board, clinicians, patients, regulator, insurer), and constraints (budget, clinical downtime windows).
Risk criteria. Build criteria before scoring: (1) risk acceptance criteria by consequence category; (2) likelihood and impact scales with anchors; (3) significance and escalation thresholds; (4) criteria for selecting treatment options; (5) authority for accepting residual risk. Do not force every risk into euros. Use multiple consequence dimensions: patient safety, confidentiality, integrity, availability, regulatory, financial, and reputation. Monetise where defensible, but preserve safety thresholds.
Reconciling 'zero risk'. ISO/IEC 27005 treats risk as the effect of uncertainty on objectives; risk can be modified, avoided, shared, or retained, but residual risk remains. A literal zero-risk appetite is not operable: it gives no basis for prioritisation or acceptance and conflicts with clinical need, such as the unsupported MRI system. Reinterpret the board statement as: no unmitigated high risk to patient safety or critical clinical availability; financial and reputational risks may be accepted within defined bands; all high safety risks escalate to the executive committee. Record the reinterpretation, obtain top-management approval, and explain it to the board in plain language. This is a risk-criteria decision, not a technical one, and should be linked to the ISMS risk process required by ISO/IEC 27001.
2. The CISO proposes to assess the unsupported MRI operating system as a 'high' risk. The vendor's upgrade is not available until 2027. What treatment options are credible, and what should be recorded to show due diligence?
Read the worked answer
Treatment options. Modify is the main credible route: isolate the MRI suite on a dedicated VLAN, deny traffic by default, restrict vendor remote access through a jump host with MFA, harden local accounts, restrict removable media, add network monitoring, test offline backups, and document a downtime procedure. Avoid could mean disconnecting the scanner from the network and using a standalone workflow, but that may reduce clinical capability and business efficiency. Early replacement or decommissioning is an avoid option but has major capital and service implications. Share/transfer through vendor contractual commitments and cyber insurance may reduce financial impact, but it does not transfer patient-safety or regulatory accountability. Retain is possible only as a documented residual risk accepted by the appropriate executive, not by the CISO alone.
Due diligence record. Record the risk scenario, affected assets, existing controls, the options considered, cost and clinical impact of each, the risk owner (for example, the COO or CMO), and the escalation to the executive committee because of safety consequences. Document the residual risk statement, compensating controls, time-bound upgrade plan, monitoring indicators, review dates, and the rationale for interim acceptance. 'The vendor will not upgrade until 2027' is a constraint, not an acceptance rationale. Show that patient safety was evaluated against the approved criteria and that clinical leadership was consulted.
3. How should the CFO's request for a single euro-ranked list be handled without undermining the risk assessment?
Read the worked answer
Explain that ISO/IEC 27005 does not require every risk to be monetised, and that ordinal scores must not be treated as precise cardinal values. Some impacts can be estimated in euros: downtime cost per hour, contract penalties, regulatory fines, and recovery effort. Others, especially patient-safety and reputational consequences, are not reliably monetisable and should not be forced into a false common unit.
Use a consistent register with impact dimensions and a separate monetised estimate where evidence exists. Rank risks within categories or by risk band, and present the board with the top risks, the band, the confidence level, the owner, and the decision required. Avoid summing risk scores across the register; that creates false precision and hides correlated risks. If the CFO needs a financial view, provide scenario-based estimates with assumptions and ranges, and clearly label them as estimates. The result satisfies the request for prioritisation without pretending that a safety risk and a software-licensing risk are directly comparable in euros.